Effective Date: March 8, 2026 | Last Updated: March 8, 2026
Your privacy is important to us. This Privacy Policy explains how Heimat LLC, a Wyoming limited liability company doing business as RealBody.AI ("Company," "we," "us," or "our"), collects, uses, stores, shares, and protects your personal information when you visit our website at https://realbody.ai or use our LLC formation and business services platform (collectively, the "Platform").
We are committed to handling your personal information — especially sensitive data like your Social Security Number — with the highest standards of security and discretion. Please read this Policy carefully. By using our Platform, you agree to the practices described herein.
This Policy applies to all users of the RealBody.AI platform, including visitors, registered users, and paying customers. It does not apply to information collected by third parties who may link to or be accessible from our Platform.
Questions about this Policy? Contact us at support@realbody.ai.
We collect the following categories of information:
To comply with our obligation to verify the identity of customers forming legal entities, we require identity verification through our KYC partner, Persona. This process collects:
This data is collected and processed by Persona. Please review Persona's Privacy Policy at withpersona.com. See Section 6 regarding KYC data retention.
If you are a U.S. person applying for an EIN through our platform, we collect your SSN or ITIN solely for the purpose of completing IRS Form SS-4. See Section 4 (SSN Handling) for complete details on how we protect this data.
Payments are processed by Stripe, Inc. We do not collect or store your credit card number, CVV, or full payment card details. We receive from Stripe only: the last four digits of your card, card brand, expiration date, billing address (for fraud prevention), and payment status/transaction IDs. Stripe's handling of your payment data is governed by Stripe's Privacy Policy.
When you use our wallet generation service, we generate an Ethereum-compatible wallet address and private key on your behalf. The private key is displayed to you once and immediately deleted from our systems. We retain only your public wallet address for reference in your account. We never have access to your funds or private key after generation.
| Purpose | Data Used | Legal Basis |
|---|---|---|
| LLC formation — filing Articles of Organization with Wyoming SOS | Name, address, formation data, account data | Contract performance; legal obligation |
| EIN application — completing and submitting IRS Form SS-4 | SSN/ITIN, name, formation data | Explicit consent; contract performance |
| Identity verification (KYC) | Government ID, selfie, date of birth | Legal obligation; legitimate interests (fraud prevention) |
| Payment processing and billing | Payment data, account data | Contract performance |
| Account management and customer support | Account data, communications data | Contract performance; legitimate interests |
| D-U-N-S number registration | Formation data, name, address | Contract performance |
| Phone number provisioning | Name, address, account data | Contract performance |
| Platform security and fraud prevention | Usage data, IP address, account data | Legitimate interests |
| Legal compliance and regulatory obligations | All relevant data | Legal obligation |
| Service-related communications (account notifications, renewal reminders) | Email, account data | Contract performance; legitimate interests |
| Platform improvement and analytics (aggregated, non-identifiable) | Usage data | Legitimate interests |
We do not use your personal information for behavioral advertising, profiling, or sale to third parties.
This section describes in detail how we handle your Social Security Number (SSN) or Individual Taxpayer Identification Number (ITIN), which we treat as the most sensitive category of personal data on our platform.
The IRS requires that a Responsible Party's SSN or ITIN be listed on Form SS-4 to issue an EIN. We collect this information for one purpose only: to complete and submit IRS Form SS-4 on your behalf as your authorized Third Party Designee. There is no other use.
Your SSN is transmitted from your browser to our servers exclusively over TLS 1.2 or higher (HTTPS) encrypted connections. It is never transmitted in plaintext. Our platform enforces HTTPS at all times and does not accept unencrypted connections.
Your SSN is stored in our database using AES-256-GCM encryption with a securely managed encryption key stored separately from the encrypted data. Your SSN is never stored in plaintext at any point — not in the database, not in application logs, not in error logs, not in backup files, and not in any monitoring or analytics system.
Access to the encryption key and the ability to decrypt SSN data is restricted to the automated systems that execute the Form SS-4 filing process. No human employee has routine access to SSN data in decrypted form. Any exceptional access would require elevated authorization and would be logged.
Your SSN is used exclusively to populate the appropriate fields on IRS Form SS-4 and to submit that form to the IRS. It is not used for any other purpose, not cross-referenced with other data, and not included in any analytics or reporting.
Your SSN is shared only with the IRS as part of Form SS-4. It is not shared with any other third party — not Stripe, not Persona, not Unit.co, not Telnyx, not D&B. We do not sell, rent, or trade your SSN under any circumstances.
Upon confirmation that your EIN has been issued by the IRS, your SSN is permanently deleted from our systems within 24 hours. "Permanently deleted" means it is removed from the primary database, purged from any backup that was taken after EIN issuance, and confirmed deleted. After deletion, we retain only your EIN (which is not sensitive and is necessary for account records).
If an EIN application is rejected by the IRS or cannot be completed, we will retain your SSN only for as long as is necessary to resolve the issue (e.g., correct the application and resubmit) and will delete it within 24 hours of final resolution. We will notify you of the status and the expected deletion timeline.
We work with the following third-party service providers who may process your data on our behalf:
| Provider | Purpose | Data Shared | Privacy Policy |
|---|---|---|---|
| Persona | Identity verification (KYC) | Government ID images, selfie, date of birth, name, address | withpersona.com |
| Stripe, Inc. | Payment processing | Payment card data, billing address, transaction amounts | stripe.com/privacy |
| Unit.co / i3 Bank | Business banking services (U.S. customers only) | Name, address, formation data, as required for account opening | unit.co |
| Telnyx LLC | Business phone number provisioning | Name, business address, number request | telnyx.com |
| Dun & Bradstreet (D&B) | D-U-N-S Number registration | Business name, address, formation data, contact info | dnb.com |
| Resend | Transactional email delivery | Email address, email content | resend.com |
| Vercel / Hosting Provider | Platform hosting and content delivery | Usage data, IP addresses (passed through infrastructure) | vercel.com |
| Internal Revenue Service (IRS) | EIN application (Form SS-4) | SSN/ITIN, name, formation data | U.S. government agency — subject to federal privacy law |
| Wyoming Secretary of State | LLC formation filing | Formation data, name, registered agent info | State government — public record |
All third-party providers are selected based on their ability to maintain appropriate security standards. We do not sell, rent, or trade your personal information with any party not listed above.
Note on public records: Information included in your Wyoming Articles of Organization (LLC name, registered agent, principal office address) becomes part of the public record maintained by the Wyoming Secretary of State. This is a legal requirement of LLC formation, not a choice made by RealBody.AI.
Identity verification data (government ID images, selfie/liveness data, and associated verification results) collected through Persona is subject to Persona's own data retention policies, which are designed to comply with applicable anti-money laundering (AML) and Know Your Customer (KYC) regulatory requirements.
These regulations typically require retention of identity verification records for a period of five (5) years or longer from the date of verification, depending on the applicable jurisdiction and regulation. Persona retains this data on our behalf in accordance with their legal obligations and their privacy policy.
You may request information about Persona's retention practices by contacting support@realbody.ai, and we will facilitate your inquiry with Persona. Please note that we may not be able to fulfill deletion requests for KYC data where retention is required by law.
| Data Category | Retention Period | Reason |
|---|---|---|
| Account data (name, email, account history) | Duration of account + 7 years after closure | Legal and tax record-keeping obligations |
| SSN / ITIN | Deleted within 24 hours of EIN confirmation (or resolution of failed application) | Minimization — no longer needed after EIN issuance |
| Identity verification (KYC) | Per Persona's retention policy (typically 5+ years) | AML/KYC regulatory requirements |
| LLC formation documents | Duration of account + 7 years | Legal and tax record-keeping obligations |
| Payment records and invoices | 7 years | Tax record-keeping; legal compliance |
| Payment card data | Per Stripe's policy (we retain only last 4 digits, expiry, token) | Stripe manages full card data; we retain only what is necessary for billing management |
| Support communications | 3 years from last interaction | Customer service continuity; dispute resolution |
| Usage and technical data (logs) | 90 days | Security monitoring; debugging |
| Crypto wallet public address | Duration of account | Account reference — private key is deleted immediately after display |
When data is deleted, we take steps to ensure it is removed from active databases, backup systems (within normal backup cycle), and any derived datasets.
We implement industry-standard and, where appropriate, above-standard security measures to protect your personal information:
No security system is impenetrable. While we take extensive measures to protect your data, we cannot guarantee absolute security. In the event of a breach, we will notify affected users promptly and take all reasonable steps to mitigate harm.
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):
You have the right to request that we disclose: the categories and specific pieces of personal information we have collected about you; the categories of sources from which we collected it; the business or commercial purposes for collecting it; and the categories of third parties with whom we have shared it.
You have the right to request that we delete personal information we have collected from you, subject to certain exceptions (e.g., data we are legally required to retain).
You have the right to request correction of inaccurate personal information we maintain about you.
We do not sell, rent, or share your personal information for cross-context behavioral advertising. There is nothing to opt out of. We do not have a "Do Not Sell" process because we do not sell data.
Sensitive personal information (such as your SSN) is used only to provide the specific service for which it was collected (EIN filing). We do not use it for any other purpose.
We will not discriminate against you for exercising any of your CCPA rights. We will not deny you services, charge different prices, or provide a different quality of service because you exercised your privacy rights.
To exercise any of the above rights, contact us at:
If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction with comprehensive data protection laws, you have the following rights under the General Data Protection Regulation (GDPR) or equivalent applicable law:
RealBody.AI is operated from the United States. If you are located outside the United States, your personal data will be transferred to and processed in the United States. These transfers are conducted under appropriate safeguards, including Standard Contractual Clauses (SCCs) as approved by the European Commission, to ensure your data receives a level of protection consistent with GDPR requirements.
We process personal data under the following lawful bases: (a) contract performance — to provide services you have requested; (b) legal obligation — to comply with applicable laws; (c) legitimate interests — for fraud prevention, platform security, and service improvement; and (d) consent — for SSN collection and where otherwise required.
To exercise your GDPR rights, email support@realbody.ai with "GDPR Data Request" in the subject line. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
We use minimal tracking technologies on the RealBody.AI platform:
Because we use only essential cookies and functional local storage, we do not display a cookie consent banner. If this changes in the future, we will update this Policy and seek appropriate consents.
The RealBody.AI platform is intended solely for use by individuals who are at least 18 years of age and have the legal capacity to form a limited liability company. We do not knowingly collect personal information from anyone under 18 years of age.
If we discover that we have inadvertently collected personal information from a minor, we will delete that information promptly. If you believe we have collected information from a minor, please contact us immediately at support@realbody.ai.
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When we make material changes, we will:
For non-material changes (e.g., clarifications, formatting, or changes that do not affect how we use your data), we may update this page without prior notice.
Your continued use of the Platform after the effective date of the updated Policy constitutes your acceptance of the changes. If you disagree with any changes, you may cancel your account and request deletion of your data.
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Heimat LLC d/b/a RealBody.AI
Privacy Inquiries
30 N Gould St Ste R
Sheridan, WY 82801
support@realbody.ai
For CCPA requests, include "CCPA Privacy Request" in the subject line.
For GDPR requests, include "GDPR Data Request" in the subject line.
For all other privacy inquiries, include "Privacy Inquiry" in the subject line.
We aim to respond to all privacy-related inquiries within 10 business days for general inquiries and within the legally required timeframes for formal rights requests.